PKI toolkit
Five everyday PKI jobs, each done by the published pkinative build running in this tab. Every value below is what the exports a caller gets from npm returned; nothing is mocked and nothing is uploaded. A refusal is shown as the PkiError that was thrown — its stable code and its class — because that is what your code would branch on.
PEM, DER, hexadecimal and base64
Paste PEM, hexadecimal or base64 and read it back in the other forms. PEM is decoded by decodePem under RFC 7468 — strict by default, so a header line or a wrong line length is a refusal you can see; written by encodePem.
OID resolver
Type a dotted OID, the hexadecimal content of an OBJECT IDENTIFIER, or a name to search the registry. isValidOid says whether the text is an OID at all, getOidName names it, encodeOid and encodeObjectIdentifier give its content octets and its whole TLV, and decodeOid reads hexadecimal back.
Fingerprints and key identifiers
The digests a certificate is pinned, logged and matched by. computeFingerprint hashes the DER in pure TypeScript, computeFingerprintAsync through Web Crypto — the page shows both, and that they agree. computeKeyIdentifier derives the key identifier of RFC 5280 §4.2.1.2 from the public key, which this page then compares with the subjectKeyIdentifier the certificate carries.
Requests, revocation lists and OCSP responses
Drop or paste a certification request, a CRL or an OCSP response, in DER or PEM. The kind is read from the PEM label, or tried in that order: parseCertificationRequest then verifyCertificationRequest, parseCertificateList with findRevocation and verifyCrlSignature, parseOcspResponse with verifyOcspSignature.
No request at hand? Make a CSR asks this page — not pkinative — to generate an ephemeral ECDSA P-256 key pair with crypto.subtle.generateKey. pkinative never generates keys: it receives the non-extractable private CryptoKey and passes it to Web Crypto to sign, inside createCertificationRequest. The key exists in this tab only and is gone when you leave it.
Drop a .csr, .crl, .der or .pem file here, or press Enter to choose one. It is read in this tab only.
Chain verdict
verifyCertificateChain builds the path from the leaf through the candidates to a trust anchor, checks every signature with Web Crypto, every validity window at the instant you choose, and the host name when you give one — and answers with valid and the full list of reasons, never only the first. Every PKI_REASON_* code is registered in reasons.json.
The samples hold two complete chains (R12 under ISRG Root X1, E7 under ISRG Root X2). The letsencrypt.org leaf is different on purpose: parsing it shows it was issued by YE2, an intermediate of Let's Encrypt's newer hierarchy that is not among the samples — so its honest verdict is PKI_REASON_NO_TRUST_ANCHOR until you paste YE2 and its root below. pkinative fetches nothing: the leaf names where its issuer is published, and getting it is yours.
Where to go from here
- Pin a public key, not a certificate and validate a chain — the same calls, in TypeScript
- Ask a revocation list about one certificate and ask a responder
- The CLI does all five from a shell —
pkinative pem,oid,fingerprint,csr,crl,ocsp,chain verify— and the command builder writes the line; its use cases run them in CI - The errors guide reads every refusal code, diagnostic and reason